Omnicit.EntraRBAC.psd1
|
@{ RootModule = 'Omnicit.EntraRBAC.psm1' ModuleVersion = '1.2.1' CompatiblePSEditions = @('Core') GUID = '7b9e4a1c-2d6f-4f3a-9c8b-1e5d0a7c3f42' Author = 'Omnicit AB / Philip Haglund' CompanyName = 'Omnicit' Copyright = '(c) 2026 Omnicit AB' Description = 'Manage Entra ID and Azure RBAC building blocks across tenants: Entra ID groups, PIM, Administrative Units, Entitlement Management, Access Reviews, Azure resources and RBAC, plus a JSON inventory and declarative apply engine.' PowerShellVersion = '7.2' RequiredModules = @( @{ ModuleName = 'AzAuth'; ModuleVersion = '2.9.0' } @{ ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '2.36.0' } ) # Loaded via Update-TypeData in suffix.ps1 (Remove-Module does not clean type data). TypesToProcess = @() FormatsToProcess = @('Formats/Omnicit.EntraRBAC.Format.ps1xml') FunctionsToExport = @('Add-OERAccessPackageResourceRole','Add-OERAdministrativeUnitMember','Add-OERAdministrativeUnitScopedRole','Add-OERCatalogResource','Add-OERGroupEligibility','Add-OERGroupMember','Connect-OER','Disable-OEREligibleRoleAssignment','Disconnect-OER','Enable-OEREligibleRoleAssignment','Export-OERInventory','Get-OERAccessPackage','Get-OERAccessPackageAssignment','Get-OERAccessPackageAssignmentPolicy','Get-OERAccessPackageResourceRole','Get-OERAccessReviewDefinition','Get-OERAccessReviewInstance','Get-OERAccessReviewInstanceDecision','Get-OERActiveDirectoryRoleAssignment','Get-OERActiveRoleAssignment','Get-OERAdministrativeUnit','Get-OERAdministrativeUnitScopedRole','Get-OERAuthenticationContext','Get-OERCatalog','Get-OERCatalogResource','Get-OERConfiguration','Get-OERDirectoryRoleManagementPolicy','Get-OEREligibleDirectoryRoleAssignment','Get-OEREligibleRoleAssignment','Get-OERGroup','Get-OERGroupEligibility','Get-OERGroupMember','Get-OERGroupPimPolicy','Get-OERInventory','Get-OERManagementGroup','Get-OERRequiredScope','Get-OERResource','Get-OERResourceGroup','Get-OERRoleAssignment','Get-OERRoleDefinition','Get-OERRoleManagementPolicy','Get-OERSubscription','Invoke-OERAccessReviewInstanceDecision','Invoke-OERStructure','New-OERAccessPackage','New-OERAccessPackageApprovalStage','New-OERAccessPackageAssignment','New-OERAccessPackageAssignmentPolicy','New-OERAccessPackageRequestorScope','New-OERAccessPackageRequestorSettings','New-OERAccessReviewDefinition','New-OERAccessReviewStage','New-OERActiveDirectoryRoleAssignment','New-OERActiveRoleAssignment','New-OERAdministrativeUnit','New-OERCatalog','New-OERConfiguration','New-OEREligibleDirectoryRoleAssignment','New-OEREligibleRoleAssignment','New-OERGroup','New-OERPolicyNotificationRule','New-OERResourceGroup','New-OERRoleAssignment','Remove-OERAccessPackage','Remove-OERAccessPackageAssignment','Remove-OERAccessPackageAssignmentPolicy','Remove-OERAccessPackageResourceRole','Remove-OERAccessReviewDefinition','Remove-OERActiveDirectoryRoleAssignment','Remove-OERActiveRoleAssignment','Remove-OERAdministrativeUnit','Remove-OERAdministrativeUnitMember','Remove-OERAdministrativeUnitScopedRole','Remove-OERCatalog','Remove-OERCatalogResource','Remove-OERConfiguration','Remove-OEREligibleDirectoryRoleAssignment','Remove-OEREligibleRoleAssignment','Remove-OERGroup','Remove-OERGroupEligibility','Remove-OERGroupMember','Remove-OERResourceGroup','Remove-OERRoleAssignment','Send-OERAccessReviewReminder','Set-OERAccessPackage','Set-OERAccessPackageAssignmentPolicy','Set-OERAccessReviewDefinition','Set-OERAdministrativeUnit','Set-OERCatalog','Set-OERConfiguration','Set-OERDirectoryRoleManagementPolicy','Set-OERGroup','Set-OERGroupPimPolicy','Set-OERResourceGroup','Set-OERRoleAssignment','Set-OERRoleManagementPolicy','Stop-OERAccessReviewInstance','Test-OERStructure') CmdletsToExport = @() VariablesToExport = @() AliasesToExport = @() PrivateData = @{ PSData = @{ Tags = @('EntraID', 'Azure', 'RBAC', 'PIM', 'Identity', 'Governance', 'PSEdition_Core', 'Windows', 'Linux', 'MacOS') ProjectUri = 'https://github.com/Omnicit/Omnicit.EntraRBAC' LicenseUri = 'https://github.com/Omnicit/Omnicit.EntraRBAC/blob/main/LICENSE' IconUri = 'https://raw.githubusercontent.com/Omnicit/Omnicit.EntraRBAC/main/assets/icon.png' RequireLicenseAcceptance = $false ReleaseNotes = '## [1.2.1-preview0010] - 2026-10-18 A PIM for Groups activation is no longer written or applied as a standing membership. `Get-OERInventory` and `Export-OERInventory` leave out a member or owner held by a PIM activation or time-bound active assignment, counted per group in `Export-OERInventory`''s README; with the PIM assignments unread, they omit eligible ones and report `InventoryPartial`. `Invoke-OERStructure` adds no member or owner PIM holds or makes eligible and `-Prune` removes none; it adds and removes no member or owner of an existing group whose PIM state is unread. Needs `PrivilegedAssignmentSchedule.Read.AzureADGroup`. `Get-OERInventory` and `Export-OERInventory` leave out role assignments at the Azure root scope `/` with a warning; the bundle README lists them as elevated access. `Test-OERStructure` warns on one, and `Invoke-OERStructure` never creates or prunes there. It updates an access review found by name only if it reviews the declared package and policy (a non-unique name must be an id), else fails it (`AccessReviewScopeMismatch`), writing nothing. `Set-OERAccessPackageAssignmentPolicy` no longer drops custom extension stages and can update an automatic assignment policy. `Test-OERStructure` refuses an invalid `mailNickname` and a scope with a dot segment, `%`, `\`, `?`, `#` or stray white space, and warns when a renamed group keeps its alias. `New-OERGroup` refuses an underivable alias. `-WhatIf` plans a package in a new catalog as created. `Invoke-OERStructure` renames administrative units, catalogs and access packages through `previousDisplayName`, like groups: the object found only under its previous name is renamed; if both names find different objects, or neither finds one, the entry fails and writes nothing. In the same run, a group created into a renamed unit and a package in a renamed catalog find the renamed object by id. Assignment policies, within their package, and access reviews are renamed the same way, and an access review that names the new name of a package or policy renamed in the same run reaches it. `Set-OERAccessPackageAssignmentPolicy` renames a policy given `-DisplayName` alone. A catalog that `Invoke-OERStructure` fails to read is now `Failed`, with nothing written to it, instead of being updated. `groupsRoster.json` rows now carry each group''s id, type, visibility and creation time. Inventories count shared group names tenant-wide, leave out same-named policies of one package (now refused in a document) and name a shared catalog, review target or role-assignment group by id; the export README lists each name and count. `Invoke-OERStructure` fails, writing nothing, when a package it would create exists in another catalog. Inventories set `principalStatus` `Deleted`/`Unresolved` for a role assignment whose principal Entra ID does not return (apply never creates it), mark failed lookups as partial and omit one at an undeclarable scope. Exports flag PIM groups in restricted units. Reviews reach a declared package via its entry, failing if `-Include` lacks `AccessPackages` (or use the id) or `-WhatIf` plans it as new. `Export-OERInventory` writes `lighthouseDelegations.json`: Azure Lighthouse delegations at the subscriptions it reads, access a managing tenant holds that no role assignment shows, as read-only findings the README lists. A failed read makes it partial. `Export-OERInventory` reads only the session tenant''s own subscriptions and names the others in its README; `Invoke-OERStructure` refuses a role assignment or policy in another tenant''s subscription. ' Prerelease = 'preview0010' } } } |